TELOS CORP 10-K

Item 1. Business Overview Telos Corporation, together with its subsidiaries (the “Company” or “Telos” or “We”), offers technologically advanced, software-based security solutions that empower and protect the world’s most security-conscious organizations against rapidly evolving, sophisticated and pervasive threats. Our portfolio of security products, services and expertise empower our customers with capabilities to reach new markets, serve their stakeholders more effectively, and successfully defend the nation or their enterprise. We protect our customers’ people, information, and digital assets so they can pursue their corporate goals and conduct their global missions with confidence in their security and privacy. The Company was incorporated as a Maryland corporation in October 1971. On November 19, 2020, we completed our initial public offering ("IPO") of shares of our common stock. We issued 17.2 million shares of our common stock at a price of $17.00 per share, generating net proceeds of approximately $272.8 million. We used approximately $108.9 million of the net proceeds in connection with the conversion of our outstanding shares of 12% Exchangeable Redeemable Preferred Stock into the right to receive cash and shares of our common stock, $30.0 million to fund our acquisition of the outstanding Class B Units of Telos ID, and $21.0 million to repay our outstanding senior term loan and subordinated debt. On April 6, 2021, we completed our follow-on offering of 9.1 million shares of our common stock at a price of $33.00 per share, including 7.0 million shares of common stock by certain existing stockholders of Telos. The offering generated approximately $64.3 million of net proceeds to Telos. We did not receive any proceeds from the shares of common stock sold by the selling stockholders. On April 19, 2021, we used approximately $1.3 million of the net proceeds to repurchase 39,682 shares of our common stock and $26.9 million to repurchase warrants to purchase 900,970 shares of our common stock owned by Enlightenment Capital Solution ("EnCap"). Further, on July 30, 2021, we used approximately $5.9 million of the net proceeds to acquire the assets of Diamond Fortress Technologies ("DFT"). We intend to use the remaining net proceeds of the IPO and the follow-on offering for general corporate purposes. We also may use a portion of the net proceeds to acquire complementary businesses, products, services, or technologies. The amounts and timing of our actual use of the net proceeds will vary depending on numerous factors. Proceeds held by us are invested in short-term investments until needed for the uses described above. Our Mission: Cyber, Cloud, and Enterprise Security Our mission is to protect our customers’ people, systems, and vital information assets with offerings for cybersecurity, cloud security, and enterprise security. In the current global environment, our mission is more critical than ever. The emergence of each new information and communications technology ("ICT") introduces new vulnerabilities, as security is still too often overlooked in solution development. Networks and applications meant to enhance productivity and profitability often jeopardize an organization due to poor planning, misconfiguration, or an unknown gap in security. Ransomware, insider threats, cybercrime, and advanced persistent threats continue to menace public and private enterprises across all industries. Cybersecurity, cloud security, and enterprise security of the modern organization share much in common, yet also call for a diverse range of skills, capabilities, and experience in order to meet the requirements of security-conscious customers. Decades of experience in developing, orchestrating, and delivering solutions across these three domains gives us the vision and the confidence to provide solutions that empower and protect the enterprise at an integrated, holistic level. Our experience in addressing challenges in one area of an enterprise helps us meet requirements in others. We understand that a range of complementary capabilities may be needed to solve a single challenge, and we also recognize when a single solution might address multiple challenges. Our security solutions span across the following domains: Cybersecurity, Cloud Security and Enterprise Security. Key Customers Our customer base consists of the United States ("U.S.") federal government, large commercial businesses, state and local governments, and international customers. Our consolidated revenues are largely attributable to prime contracts or to subcontracts with our contractors engaged in work for the U.S. government; with the remaining attributable to state, local and commercial markets. 4 Table of Contents Our federal government customers include the Department of Defense (“DoD”), the Central Intelligence Agency (“CIA”) and multiple other agencies within the Intelligence Community (“IC”), Defense Manpower Data Center, and multiple civilian agencies, including the Department of Homeland Security (“DHS”), the U.S. Department of State (“DoS”), the Federal Bureau of Investigation (“FBI”), Department of Health and Human Services ("DHHS"), and U.S. Census Bureau. These customers have a number of subsidiary agencies that have separate budgets and procurement functions. Our contracts may be with the highest level of these agencies or with the subsidiary agencies of these customers. Our commercial customers include leading enterprises such as Amazon.com, Inc., Microsoft Corporation, Zscaler and Salesforce.com, Inc. We have conducted business with over 300 customers in each of the last three years. For the year ended December 31, 2021, a significant portion of our revenue was derived from sole-source contracts or contracts for which we had limited competition. Our customers are highly targeted by cyber attackers and require continuous real-time insights to make informed decisions about how to effectively balance the constraints of security risk with the freedom to act and decide in the best interests of the organization and the greater good of the public. Our advanced security solutions help protect and ensure confidence in the information that is vital to the world’s most important commercial and governmental organizations, national security, and mission success for the war fighter. Our security solutions are the product of the extensive labor investment in developing our intellectual property and highly sophisticated software technology. These investments helped us expand with commercial customers, and win additional contracts within the military, the IC and civilian government agencies. Once our security solutions are embedded in our customers’ technology infrastructure, these customer relationships often expand and lead to us providing additional security solutions. Our Market Our market includes organizations in business across industry verticals, government, and the military. We believe that digital transformation is a reality for these organizations and that the ICT systems they depend on for their success and security are subject to unprecedented levels of stress, threat, and attack. Market-disrupting technologies, a global pandemic, and economic uncertainty make it difficult for these organizations to plan for business expansion, develop new programs in service to the public, or prepare military forces for the nation’s defense. Public and private enterprises alike face the following dynamic challenges that threaten their security: • Heavy dependence on information and operational technologies ("OT"). Organizations are increasingly dependent on technology, including mobile and wireless applications, cloud-based resources, industrial internet of things (“IoT”), industrial control systems (“ICS”), supervisory control and data acquisition (“SCADA”), and others. • Digital transformation and accelerating migration to the cloud. Enterprises and government agencies are accelerating the migration of applications, storage, and ICT/OT infrastructure to hosted and cloud environments. More organizations – including highly security-conscious agencies within the U.S. government and commercial entities – are gaining comfort and confidence in the cloud, taking advantage of the rapid application development, greater flexibility, and strategic agility that the cloud offers. • Ability to work across and beyond the enterprise. Organizations are no longer defined by or confined by real estate, geography, or personnel rosters. Information and applications are now accessible in the cloud. Mobile devices free personnel to work wherever their mission takes them. Employees, contractors, and partners collaborate in the physical and digital domains, trusting that they can rely on the integrity and trustworthiness of their people and their systems. • Turbulent technology environment due to Coronavirus disease 2019 (" COVID-19"). The COVID-19 pandemic has accelerated the growth of the remote workforce and thus, cyber risk. Existing technologies for mobility are being stretched to the limit, and enterprises are facing dramatic growth in cyberattack risk as a result of personnel and systems that are still adjusting to an increasing number of workers accessing systems remotely. Ransomware, phishing attempts, and inadequate virtual private networks (“VPNs”) all contribute to a significant increase in threats and vulnerabilities. The networked nature of enterprise technologies and the ability to work outside the organizational perimeter result in increased risk and the constant threat of attack. In particular, the cloud adds new complexities due to the shared responsibility of cloud security and the need to manage and maintain the compliance of cloud-based resources. 5 Table of Contents Our solutions across a wide variety of use cases are designed to address our customers’ proliferating need to understand and address cybersecurity risk, reduce the organizational attack surface, enhance enterprise mobility, expand adoption of cloud computing, and manage and protect identities in an increasingly dynamic and intensifying threat landscape. By addressing the breadth of our customers’ complex and evolving needs, we believe that our total addressable market in 2022 for the security services and products that we provide is over $80 billion. Business Segments During the last quarter of 2021, we changed our segment reporting to reflect changes to our organization and leadership structure. These changes align with the Company's operational and strategic objectives and mission to meet the customer demand for information technology ("IT") solutions. As a result, we established two segments - Security Solutions and Secure Networks - which previously was one operating and reportable business segment. With these changes, the following is a description of the principal activities that comprise each of our two operating segments: Security Solutions: The Security Solutions segment focuses on cybersecurity, cloud, and identity solutions. Cybersecurity solutions help our customers ensure the ongoing security, integrity and compliance of their on-premises and related cloud-based systems by reducing threats and vulnerabilities to foil cyber adversaries before they can attack. Our security engineers and subject matter experts assess our customers’ cybersecurity environments and design, engineer, and operate systems needed to strengthen their cybersecurity postures. Our cloud solutions leverage the specialized skills and experience needed to help our customers plan, engineer, execute and accelerate secure cloud migrations while assuring ongoing management and security of enterprise cloud technology environments. Our identity solutions deliver digital identity, biometric, and nationwide enrollment services and address Know Your Customer ("KYC") and identity management challenges for enterprises working within regulated and critical infrastructure environments. Security Solutions represented 51.0%, 65.2% and 64.0% of total revenues for fiscal 2021, 2020 and 2019, respectively. Secure Networks: The Secure Networks segment provides secure networking architectures and solutions to the DoD, IC and other federal governmental agencies. Our net-centric solutions enable collaboration and connectivity in order to increase efficiency, reduce costs, and improve mission outcomes. Telos provides an extensive range of wired and wireless, fixed and deployable, classified and unclassified voice, data, and video secure network solutions and services to support defense and civilian missions. Capabilities include network design, operations, and sustainment; system integration and engineering; network security and compliance; deployable comms; innovation and digital transformation; service desk; defensive cyber operations; and program management. Secure Networks represented 49.0%, 34.8% and 36.0% of total revenues for fiscal years 2021, 2020 and 2019, respectively. Additional information regarding our segments is presented in Note 1 7 - Segment Information to the consolidated financial statements at Item 8 of this Form 10-K. Our Offerings We refer to our cyber and cloud applications as Security Solutions, which includes Information Assurance / Xacta ® , Secure Communications, and Telos ID. We refer to our offerings for enterprise security as Secure Networks. Security Solutions • Information Assurance / Xacta : a premier platform for enterprise cyber risk management and security compliance automation, delivering security awareness for systems in the cloud, on-premises, and in hybrid and multi-cloud environments. Xacta delivers automated cyber risk and compliance management solutions to large commercial and government enterprises. Across the U.S. federal government, Xacta is the de facto commercial cyber risk and compliance management solution. 6 Table of Contents • Secure Communications: ◦ Telos Ghost ® : a virtual obfuscation network-as-a-service with encryption and managed attribution capabilities to ensure the safety and privacy of people, information, and resources on the network. Telos Ghost seeks to eliminate cyberattack surfaces by obfuscating and encrypting data, masking user identity and location, and hiding network resources. It provides the additional layers of security and privacy needed for intelligence gathering, cyber threat protection, securing critical infrastructure, and protecting communications and applications when operations, property, and even lives can be jeopardized by a single error in security. ◦ Telos Automated Message Handling System (“AMHS”) : web-based organizational message distribution and management for mission-critical communications; the recognized gold standard for organizational messaging in the U.S. government. Telos AMHS is used by military field operatives for critical communications on the battlefield and is the only web-based solution for assured messaging and directory services using the Defense Information System Agency’s (“DISA”) Organizational Messaging Service and its specialized communications protocols. • Telos ID : offering identity trust and digital services through IDTrust360 ® – an enterprise-class digital identity risk platform for extending flexible hybrid cloud identity services enabled for mobile and enterprise environments and custom digital identity services that mitigate threats through the integration of advanced technologies that fuse biometrics, credentials, and other identity-centric data used to continuously monitor trust. In April 2021, Telos announced the acquisition of DFT, whose ONYX ® touchless mobile fingerprint software is being integrated with the IDTrust360 platform. We maintain government certifications and designations that distinguish Telos ID, including Transportation Security Administration ("TSA") PreCheck ® enrollment provider, Designated Aviation Channeling ("DAC") provider, FBI-approved Channeler, and the Financial Industry Regulatory Authority (“FINRA”) Electronic Fingerprint Submission provider. Secure Networks • Secure Mobility : solutions for business and government that enable remote work and minimize operational and security concerns across and beyond the enterprise. Our secure mobility team brings credentials to every engagement, supplying deep expertise and experience as well as highly desirable clearances and industry-recognized certifications for network engineering, mobility, and security. • Network Management and Defense : services for operating, administrating, and defending complex enterprise networks and defensive cyber operations. Our diverse portfolio of capabilities addresses common and uncommon requirements in many industries and disciplines, ranging from the military and government agencies to Fortune 500 companies. Xacta Xacta Overview Xacta delivers automated cyber risk and compliance management solutions to large commercial and government enterprises. Xacta is sold as a solution, which includes Xacta technology and Xacta subject matter experts (“SMEs”) to help with deployment, ongoing support, and training to ensure rapid and long-term customer success. Our solution-based business model provides predictable, recurring, and growing revenue year-on-year. Xacta disrupted the cyber risk and compliance management industry 20 years ago. When it was first introduced, Xacta represented a new way of doing business that challenged the inefficient labor-intensive business models of traditional consultants and government contractors who charge by the hour. Over the past two decades, we have developed and evolved Xacta to make security risk and compliance activities more efficient through intelligent workflow-based automation. Many cyber risk and compliance management activities can be automated via our data interrogation capabilities, which greatly reduces the need for inefficient Time and Materials (“T&M”) services. More importantly, we believe that certain critical capabilities like continuous monitoring are effectively impossible without automation. 7 Table of Contents Xacta is the de facto commercial cyber risk and compliance management solution across the U.S. federal government. Noteworthy U.S. government enterprise customers include DoD, multiple agencies within the IC (including the CIA), and civilian agencies such as DoS and the FBI. Xacta is also being adopted by very large commercial organizations like Amazon Web Services (“AWS”), Microsoft Azure and Oracle Cloud Infrastructure. Across these government and commercial customers, we currently have hundreds of Xacta deployments used to manage tens of thousands of mission-critical and national security systems that are comprised of millions of critical information technology (“IT”) assets and cloud resources. There are also more than 20,000 professionals who actively use Xacta to manage cyber risk for a wide range of IT/information systems in warfighting, intelligence, business/financial, and healthcare applications. In 2016, at the request of the CIA, we evolved Xacta from an on-premises cyber risk and compliance management solution used to manage traditional IT assets, to a solution that also manages cloud resources. As a result, we believe that Xacta is unique in its ability to manage complex hybrid IT environments that span on-premises, cloud, and multi-cloud. Our cloud focus has attracted the attention of the world's largest cloud and cloud service providers, many of which are now our partners and customers. These partnerships have greatly increased our market opportunity, as many organizations look to migrate to the cloud. Security compliance remains a major inhibitor to cloud adoption. Xacta addresses this issue by automating and accelerating security compliance activities allowing organizations to migrate to the cloud more quickly and securely. Recognizing these advantages, three of the largest cloud providers in the world, AWS, Microsoft Azure and Oracle Cloud Infrastructure, have partnered with Telos to use Xacta to accelerate security compliance activities in their high-security, air-gapped environments. Our cloud focus has also resulted in significant partnerships with other cloud organizations and other cloud providers (i.e. Rackspace Technology, Inc.), which are helping Software as a Service ("SaaS") vendors address cloud compliance requirements, including the Federal Risk and Authorization Management Program (“FedRAMP”), which the federal government requires for all SaaS solutions. These organizations understand that Xacta’s ability to reduce the security compliance burden helps accelerate cloud adoption and generates cloud usage and revenue more quickly. Xacta’s capabilities are strategic advantage by cloud-centric organizations. Managing cyber risk is top-of-mind for many organizations today. There is an increasing number of security standards and regulations with which global organizations must comply. The National Institute of Standards and Technology (“NIST”) is the source for many security standards that are being adopted globally. Telos, using Xacta, has specialized in supporting NIST-based standards for approximately 20 years. We have been considered by a leading, third-party consultancy to be NIST-based cybersecurity domain experts. Xacta’s Critical Capabilities Xacta offers a number of critical and differentiated capabilities that support a wide range of cyber risk and compliance management use cases, such as: • Automated asset inventory – helps quickly define IT boundary and parameters, and establish audit and test plans. • Automated control validation – reduces the manual test efforts. • Automated continuous control monitoring – offers ongoing assurance of compliance. • Vulnerability management functionality – understand vulnerabilities that apply to IT environments. • Remediation management – workflow to help organizations prioritize risk, establish remediation plans, and track remediation progress to closure. • Automated regulatory report generation – reduces the manual effort needed to create regulatory reports (bi-product of the workflow process). • Cloud integration – allows Xacta to manage cloud-based resources (multi-cloud environments) as well as on-premises assets. • Cloud deployment – allows Xacta to be deployed as a SaaS, Virtual Machine Image (“VMI”), Amazon Machine Image, and Microsoft Azure VMI, as well as on-premises. • Intelligent workflow – Artificial Intelligence (“AI”)-like functionality reduces the need for manual intervention. • Predictive control mapping – AI-like functionality helps reduce redundant control testing and manual control mapping effort to help address audit fatigue. • Automated control inheritance – allows organizations to share common compliance information. Cloud providers share common controls with customers as per the shared responsibility model of cloud security, which greatly reduces manual effort and enables rapid cloud adoption. • Visualization and reporting – reduces dependency on third-party business intelligence products. 8 Table of Contents • End-to-end workflow capabilities – support for complex system authorization processes like FedRAMP and the NIST Risk Management Framework, dramatically reducing time, cost, and effort. • Evidence of security posture compliance – designed to provide the body of evidence needed for regulatory or legal proceedings and insurance claims to verify security posture compliance with industry best practices at the time of an event. Xacta Evolution Xacta was launched in August 2000 and was the first automated solution of its kind. Xacta was initially created to help U.S. government organizations satisfy demanding security risk and compliance management requirements. In 2004, Xacta was enhanced to provide industry-first automated continuous monitoring functionality. Between 2002 and 2005, Telos was issued five patents in the area of security risk and compliance management, including one patent for what is now known as continuous monitoring. Since then, numerous technical enhancements have been made to Xacta, some of which are described above in “Xacta’s Critical Capabilities.” Xacta supports other NIST frameworks such as the NIST Cybersecurity Framework (“CSF”), which was established in 2014 via Executive Order 13636 to help commercial organizations in the 16 DHS-defined critical infrastructure sectors improve their cyber risk posture. Executive Order 13800, issued in 2017, requires federal agencies to adopt the CSF, and it is also being adopted by many countries as a national cybersecurity standard. Xacta also currently supports various vendor and supply chain risk management standards such as NIST Special Publication 800-161 and NIST Special Publication 800-171. NIST 800-171 is a contractual requirement for approximately 70,000 commercial companies that support the U.S. federal government. Xacta will also support an emerging standard called Cybersecurity Maturity Model Certification, which will soon be required by more than 300,000 commercial organizations that support DoD. Xacta has highly customizable workflows that can be configured to support most any cybersecurity/risk and compliance management frameworks. To that end, Xacta can support national and international security compliance standards such as HIPAA, PCI-DSS, ISO 27000, and many others. Xacta does not require a customer to abandon (i.e., rip and replace) its existing solutions – rather, it works with the customer’s prior software choices and uses those software choices as data feeds so that Xacta can perform automated (and continuous) security compliance validation. Xacta use cases include audit management, compliance management, inventory management, vulnerability management, continuous compliance monitoring, vendor and supply chain risk management, cyber risk management, risk remediation management, and security authorizations. These use cases are broadly applicable across industry verticals globally and help explain the large and expanding market in which Xacta participates. Our goal is to make Xacta the default security risk and compliance management solution of choice for commercial and government entities across the globe that seek continuous compliance with cybersecurity and risk management frameworks and standards. Telos Ghost Telos Ghost Overview As cyber threats have increased in scope and scale and the consequences of hacks and breaches have grown, we have developed a solution that enables organizations to work on the internet without being detected. In 2018, we introduced Telos Ghost, which allows our customers to shield critical assets, communications, transactions, and even their very presence on the web from the view of cyber adversaries. 9 Table of Contents Conceived on the notion that “you can’t exploit what you can’t see,” Telos Ghost provides organizations a virtually anonymous way to do business, connect with global resources, and conduct research online. Telos Ghost is a virtual obfuscation network-as-a-service that: • Obscures and varies network pathways to prevent adversaries from tracking users and information; • Uses multiple layers of encryption to protect information and remove source and destination IP addresses, eliminating network paths back to the source; • Enables users to manage their technical and non-technical persona to disguise their identity and location; and • Hides critical network resources and sensitive corporate assets using cloaked capabilities for email, storage, unified communications, and other applications. Telos Ghost seeks to eliminate cyber-attack surfaces by obfuscating and encrypting data, masking user identity and location, and hiding network resources. It provides the additional layers of security and privacy needed for intelligence gathering, cyber threat protection, securing critical infrastructure, and protecting communications and applications when operations, property, and even lives can be jeopardized by a single error in security. Telos Ghost Critical Capabilities • Private Web Access: Secure, anonymous internet access. Telos Ghost disguises the identity and location of personnel when using the public web for cyber threat intelligence and competitive research. It provides users with dynamic access for every session and assures that traffic securely traverses the virtual private lines of Telos Ghost. Scalable and flexible, Telos Ghost Private Web Access allows users multiple points of international or domestic egress to the public internet based on customer requirements. Traffic mixing and misdirection techniques are designed to ensure that activity remains anonymous, obscure and private. • Private Network Access: Leased-line security with VPN flexibility. This capability is designed to allow authorized users to work with mission-critical enterprise information without being seen or discovered. It enables the establishment of sustainable cybersecurity infrastructure, providing multi-layered secure tunnels for data traffic and obscuring the correlation between the entry doorways and the client cloud from external observers. Software and system agnostic and accessible from nearly any device and location, Telos Ghost Private Network Access is designed to provide a full security solution while maintaining existing encryption and software services. • Cloaked Services: Hidden unified mobile communications, storage, and applications. Telos Ghost also provides remote users with the ability to securely talk, text, email, store information, and use video and applications over nearly any mobile device. These abilities include fully encrypted geo-masked hidden mobile communications for device-agnostic voice, video, chat, and data; hidden storage to store, analyze, and collaborate privately and securely within Telos Ghost; and hidden email and applications that cloaks the servers for access only by Telos Ghost users. Telos Ghost Applications • Cyber threat research. Telos Ghost provides members of a U.S. government organization with an isolated networking infrastructure that enables red team members to operate securely and privately without attracting unwanted attention. • Open-source intelligence. A U.S. government organization uses Telos Ghost to securely conduct open source cyber threat intelligence analysis. • Supply chain security vulnerability assessment . A security company that vets the vulnerability of supply chains in the Defense Industrial Base uses Telos Ghost to inspect the digital connections of the supply chain online, safe from observation by adversaries that might otherwise evade discovery. • Worldwide investigative and recovery services. A commercial firm uses Telos Ghost for cloaked online research and voice communications over mobile devices to enable secure, privatized communications as they track and recover property from nefarious actors. • Hide Critical Assets. A U.S. government organization uses Telos Ghost to hide mission-sensitive information in a cloud-based repository. Information transfer to and from this cloud-based repository is also hidden from being seen on the public internet, as well as the workstations used to perform this information transfer. 10 Table of Contents Telos AMHS Telos AMHS is used by military field operatives for critical communications on the battlefield. Since 1999, it has been one of our signature security solutions and has been one of the most widely used organizational messaging products in DoD and other agencies charged with defending U.S. national security. Telos AMHS is designed to support a range of secure messaging services to a worldwide community of U.S. military, IC, other federal government, and allied customers operating in both strategic and tactical environments. It is used to securely transmit messages that provide direction and establish a formal position, commitment, or response requiring the authority of an organization, rather than an individual, including: • Military command and control; • Cross-border authorizations; • Exchanges between military forces of sovereign nations; • High-level policy, procedure, or directives; and • Response to legal, sensitive, or personnel matters. Because Telos AMHS supports timely and reliable delivery for authoritative communications, its uses include terrorist warnings, “eyes-only” messages, military execution orders, intelligence information, overflight clearances, and Emergency Action Messages for nuclear command and control. Information exchange at this level and for these purposes requires operational requirements for time-sensitive, guaranteed delivery, precedence, high availability, and reliability. Telos AMHS is the only web-based solution for assured messaging and directory services using the DISA’s Organizational Messaging Service and its specialized communications protocols. With Telos AMHS, users are able to send and receive rich-text messages across security domains and in different formats using plain language addressing. Users can search messages, archive messages, and send attachments up to 200MB to accommodate photos and videos, including those of terrorists, most wanted notices, maps, and satellite images. More than fifty organizations around the world depend on Telos AMHS, including the Joint Staff, combatant commands, military services, defense agencies, federal agencies, and the IC. Telos AMHS provides a proven return on investment over alternative organizational messaging offerings and is being implemented on a SaaS basis by an increasing number of organizations. Telos ID Offerings Telos ID Overview Telos ID provides trusted identity and digital services that are critical for the delivery of vital citizen services that millions of Americans rely on each year. Access to these vital services requires a robust and reliable infrastructure comprised of advanced technologies, facilities, and professional staff members that can effectively deliver these services around the world. We have transformed the Telos ID business model by leveraging a flexible hybrid cloud identity services approach. We utilize our partnerships with AWS and ServiceNow, and we have fully integrated a robust suite of customer service, cybersecurity, and performance monitoring tools that align with DHS’s Continuous Diagnostics and Mitigation (“CDM”) Program that are designed to enable us to quickly deliver SaaS or turn-key solutions to our federal customers. Our digital platform extends web, mobile, and client applications that also drive professional services and product licensing opportunities. Our services are differentiated because our back-end system is intended to interface with critical homeland security and law enforcement systems and are tightly coupled with a mature, modern cloud-based platform that can scale to support large federal, state, local, and commercial programs. We maintain government certifications and designations that distinguish Telos ID, including TSA PreCheck enrollment provider, TSA DAC service provider, FBI-approved Channeler, and the FINRA Electronic Fingerprint Submission provider. Our strategic partners offer retail and on-demand service channels that further differentiate our offerings. Our established global logistics infrastructure provides responsive supply chain support. We operate a 24/7/365 full-service call center with chat-bots, AI, and virtual agent support, all of which contribute to scalability. Our network and security operations centers align with U.S. Computer Emergency Readiness Team and CDM best practices. 11 Table of Contents Telos ID Applications and Use Cases • U.S. Military ID . For more than 25 years, Telos ID’s identity trust services have provided access to health care, commissary services, and critical defense resources for more than 2,000,000 military members, their dependents, and civilian employees through the use of the Common Access Card (“CAC”). We provide near real-time data collection support on personnel movement and location information for operating forces, government civil servants, and government contractors in specified operational theaters. This system has captured over 693,000,000 scans of government, U.S. military, and contractor personnel since its inception. Our logistics infrastructure provides responsive 24-hour delivery of components to our warfighters deployed across the globe, and we custom-build our identity, credentialing, and access management solutions to function effectively in austere environments that demand reliability and performance at all times. • TSA Aviation Channeling and Vetting . To date, our TSA-approved DAC service has processed over 1,500,000 aviation workers' biographic and biometric data. Telos ID DAC services provide comprehensive background checks for those working in secure areas of U.S. commercial airports, enabling the submission of aviation worker's biographic and biometric data for a secure, efficient, cost-effective approach. Telos ID DAC services meet TSA and DHS requirements for handling personally identifiable information and biometrics. As one of only two TSA authorized DACs, we offer our aviation partners (airports, airlines, general aviation) innovative biometric, identity trust, and customer service technologies that are critical to the operation of more than half of the largest airports in the nation. We actively support nearly 100 commercial airports, airlines, and general aviation customers. We were the first DAC to offer and implement the FBI's RAP Back Service to our aviation partners, enabling continuous monitoring of aviation workers' criminal histories to mitigate the insider threat. Our Independent Secure Flight Vetting technology provides TSA-approved Secure Flight vetting for non-travelers requiring access to airport secure areas. • U.S. Census Bureau Enumerator Screening . For the 2020 U.S. Census, we processed more than 1,000,000 enumerators through our 1,100 identity service centers. Telos ID extended digital identity verification, fingerprinting, and photo services across the nation in support of U.S. Census hiring initiatives. We custom designed and deployed more than 1,300 desktop, kiosk, and mobile workstations that were operated by thousands of U.S. Census-cleared staff members. At the peak, Telos ID’s managed service supported more than 30,000 appointments per day, and our customer call center handled more than 35,000 daily calls. • TSA PreCheck Enrollment Screening . Telos ID’s award of a 10-year contract to provide enrollment services in support of the TSA PreCheck Enrollment Program presents a large, high-profile opportunity for us, and we are preparing to launch services under this program as soon as authorized by TSA. The TSA PreCheck contract is an important example of a government-sponsored, consumer-facing opportunity, in which we provide PreCheck enrollment services to individual, fee-paying applicants. Telos ID’s service will engage with the world’s leading airline, hospitality, credit card, and other Fortune 500 businesses to provide consumer marketing and loyalty program tie-ins to promote the PreCheck program. In addition, this program is expected to feature an omnichannel market approach that leverages advanced digital services to reach our customers across several market segments. • CMS Healthcare Provider Screening . Telos ID was awarded a 10-year contract to provide technology and service solutions that detect, prevent, and proactively deter fraud, waste and abuse in the Medicare and Medicaid programs. Once the CMS program is implemented, Telos ID’s digital identity trust platform and digital services is expected to offer critical technology necessary to identify and mitigate fraud across the United States. Health care providers will be required to undergo FBI-based non-criminal history checks requiring identity trust services, including identity verification, fingerprinting, and continuous monitoring. The substantial efforts by the federal health authorities to manage the pandemic and the administration of vaccines has resulted in the indefinite delay of the CMS program. Telos ID's digital trusted identity platform – IDTrust360 – is a fully integrated suite that addresses challenges pertaining to KYC, insider threats, access and authorization, regulatory compliance, and other business requirements. It delivers identity trust, multi-modal biometric capture and matching, identity assurance, identity vetting, document validation, credentialing, and numerous other capabilities. Its open architecture is supported by a flexible API gateway and a robust workflow engine that can efficiently extend individual services or offer the entire platform as a SaaS or turn-key solution for our customers. 12 Table of Contents IDTrust360 is the only commercially owned and operated platform on the market with direct interfaces to the FBI's criminal records, DHS's terrorist watch list service, Treasury's pay.gov, other government identity risk management systems, and numerous commercial identity, intelligence, and risk-based data sources. We are actively engaged with federal customers to integrate vital event records, government identification document records, and other fingerprint-based biometric records hosted across multiple agencies. This enables Telos ID to offer NIST-compliant digital identity services aligned with federal security mandates. IDTrust360 extends web, mobile, and client applications within a fully integrated low-code development environment for rapid application development. IDTrust360 ® leverages leading cybersecurity and network monitoring tools aligned with DHS CDM and industry best practices for strengthening network defense and enhancing the resiliency of our infrastructure necessary for managing and protecting millions of identity records, sensitive information, and end-point hardware components deployed across thousands of sites around the world. Telos ID customers operate in defense, homeland security and law enforcement, financial, health, commerce, transportation, retail, and other market segments. Secure Mobility Approximately 20 years ago, we were the first non-government solutions provider to receive approval to design and deliver secure wireless solutions to DoD. That authorization to operate enabled us to build a very large footprint within DoD and the U.S. Air Force. As a result, we have a long track record of enabling our customers to work remotely and securely. Given the depth of our relationships, when one of our customers elects to modernize its remote mobility infrastructure, it frequently chooses to work with us. Within the U.S. Air Force and supporting DoD communities, we have designed and delivered enterprise-level secure mobile networks on every active duty, Air National Guard, and Air Force Reserve site worldwide. Our secure mobility team brings credentials to every engagement, supplying deep expertise and experience as well as highly desirable clearances and industry-recognized certifications for network engineering, mobility, and security. We also foster and maintain key industry partnerships, offering insight into technology advances and early access to new secure mobility solutions. Network Management and Defense On a managed basis, we offer a broad suite of services needed to operate, administer, and defend complex enterprise networks, giving our customers the benefit of these capabilities without committing to the cost and burden of providing the services for themselves. We have the expertise to manage and defend large-scale enterprises and have been successful over the period of many years at hiring and retaining personnel with the necessary key skills and security clearances. Our Competitive Strengths • Leading cybersecurity company with a long history of providing security solutions to the most sophisticated customers . We have been providing security solutions, specializing in the area of cybersecurity, since 1995. Our customers include some of the most security-conscious organizations in the world, including the IC. For example, we believe that our award-winning Xacta offering is the dominant commercial risk management solution in the federal government space and is increasingly being adopted in the commercial sphere, notably by leading cloud providers such as AWS, Oracle and Microsoft Azure. Additionally, Telos Ghost gives organizations and individuals the ability to hide in plain sight, eliminating attack vectors from hackers through obfuscation and mis-attribution. And, we believe our Telos ID offerings are market disruptors that present large opportunities for growth. • Superior security solutions and capabilities . Our solutions are designed for both government and commercial industries and are configured to operate in highly sensitive, highly classified environments, serving some of the most demanding, secure organizations in the world. Our solutions are flexible and can be deployed in various ways, including on premises, in the cloud, or in hybrid or multi-cloud environments. • Proven ability to win and retain large contracts and enterprise-level deals, providing clear visibility into future revenue and profitability . We have over 30 active acquisition contracts and vehicles, thousands of active contracts and purchase orders, and more than 300 customers in each of the last three years. These contracts, vehicles and customers present a solid platform for growth. As but one example, we have provided IT security support to the Defense Manpower Data Center under a variety of contract vehicles since 1995, and this program accounts for annual revenue at a historical average of approximately $26 million over the last five years. We also have repeated proven our ability to deploy our security solutions at the enterprise level for both federal and commercial organizations. These long-term contract relationships provide predictable, recurring revenue at attractive margins. 13 Table of Contents • Our substantial investments into technology and automation can be expanded beyond our core market . Our solutions are built to help our customers be more secure, more efficient, and more effective. We have made investments across the Company to take advantage of efficiencies and automation through scalable security solutions that are market driven and market proven. In contrast to traditional cybersecurity businesses with a focus on government customers, we own the intellectual property developed through our research and development ("R&D") initiatives and can deploy our technology solutions across our entire public and private sector customer set. The ability to offer our solutions beyond the U.S. federal government sphere is a key enabler of our strategy to grow and expand our relationships with commercial customers. • Strong relationships with our customers . We are a customer-centric organization and pride ourselves on our close customer relationships. We have longstanding relationships with DoD, the IC and other civilian agencies of the federal government that date back more than two decades. Since 1995, our security solutions have been adopted by many defense, intelligence, civilian agency, and commercial customers, and we believe that the Telos brand has become synonymous with trust. • Respected, experienced management team . Our executive officers have an average tenure at Telos of over 15 years. The team is comprised of personnel with extensive military, federal government, and commercial backgrounds who are directly familiar with customer needs. Our management team also includes senior professionals who are experienced in developing commercial software solutions and leading technical teams throughout the development process. • Automation allows our customers to do more with less . The automation provided by our solutions helps customers become more efficient as they are forced to downsize their staffs or have their teams work remotely due to the COVID-19 pandemic. Automation is now even more critical to efficiently managing a business, including the ability to automate cyber risk and regulatory compliance, which should result in an increased demand for our security solutions in the future. Our Growth Strategies We are pursuing multiple strategies in order to grow the Company, in both our commercial and government business end markets. Our key strategies are: • Leverage our diverse security solutions to expand our presence in commercial markets . Our offerings are designed to have broad applications and include security risk and compliance, secure messaging, identity vetting, and managed attribution and obfuscation. We believe that we are well-positioned to sell our capabilities into a dynamic and growing commercial opportunity set and to innovate to address emerging and unique requirements. For example, we have leveraged core Xacta functionality to meet the needs of large financial services and CRM firms. We have also leveraged our U.S. federal government identity management qualifications to improve the speed and accuracy of vetting results for nearly 100 airports, air carriers, and general aviation across the country. We intend to continue innovating and are developing additional offerings for cloud, mobile, and IoT devices. • Grow our revenue and expand margins by building robust sales channels . In recent years, we have formed an inside sales organization that serves as both the direct channel to a wider account universe and an effective and efficient training program to grow our field sales organization. We are expanding our partner program to include a variety of channels, including resellers, integrators, and contract partners to help us more quickly gain access to new markets. For example, both Telos Ghost and Xacta are now available through various AWS and Microsoft Azure marketplaces, serving markets requiring varying levels of security. We have grown our direct sales team and accelerated the expansion of these channel partner initiatives, which we anticipate will drive revenue growth and material gross margin expansion over time. • Target and replace inefficient legacy products . Recognizing the limitations of their legacy systems, organizations are replacing existing systems and processes with our solutions. For example, Telos AMHS is a web-centric system that replaced legacy capabilities like communications centers for the purpose of executing operational orders (through organizational messaging) across the U.S. federal government and around the world. Xacta has disrupted the cyber risk and compliance management business across the U.S. federal government, replacing tedious manual activity with automation and delivering that automation to meet our customer’s needs flexibly on premises, in hybrid environments, in the cloud, and across multi-cloud infrastructures. 14 Table of Contents • Broaden reach within the U.S. federal government . We have historically focused on the U.S. federal government and believe that we are an established leader in providing security solutions to federal agencies, including DoD and the IC. Nonetheless, we believe the U.S. federal government represents a significant growth opportunity, and we expect to continue to invest in products to serve additional customers in this vertical. For example, Xacta is included on DHS’s CDM Approved Products List to provide federal agencies with innovative security tools, which we believe presents us with an excellent opportunity to pursue contracts with additional federal agencies. In addition, our platform is available for use in the AWS GovCloud (U.S.), Oracle and Azure Government. • Pursue strategic acquisition opportunities . We believe that our markets remain fragmented, with many niche players providing limited product solutions targeting narrow customer segments. Given the breadth of our solution set and our customer end markets, we believe that we are well-positioned to opportunistically acquire smaller companies and incorporate their technology or deploy their solutions across a larger customer set. We believe that a targeted and opportunistic acquisition strategy will complement our organic growth opportunity. Sales and Marketing Sales: Field Sales and Channel We made significant investments in sales and marketing with the goal of increasing the sales of our security solutions across a variety of verticals. As part of the sales and channel program investments, we are also making corporate investments in functional areas such as contracts, solution architects, lead generation tools, and operations to ensure our back-office systems and processes scale for the business growth. We added quota-driven, field sales personnel to focus on verticals such as the state, local government and education ("SLED"), critical infrastructure and commercial industry as well as expanded our coverage in Federal. We concentrated on Xacta and Telos Ghost sales efforts in the financial services, insurance, healthcare, energy, and other critical infrastructure markets. We have expanded our field sales capability for markets in which we are well known, such as the U.S. government, certain critical infrastructure sectors, and certain commercial verticals such as healthcare and financial services. We built a dedicated channel team of 12 members, with over 100 years of combined channel experience. We launched the Telos CyberProtect Partner Program. The program has signed 24 partners across the ecosystem. This ecosystem includes a variety of partner types including distributors (such as DLT, a tech data company), resellers, referral partners, technology integration partners, managed service providers, consulting partners and more. Collectively these partners help us deliver access to verticals such as healthcare, SLED, and commercial enterprises, and bolster our position in the Federal market. We experienced early success with the channel as we had several deals transact through the system in 2021, allowing us to pressure test the operational side of the channel. Additionally, through our channel partners, Telos was successfully added to eleven new contract vehicles that provide access to a broader base of customers in our target markets. Customer acquisition often involves extensive interaction at all levels of an organizations, from executives, to decision makers, to end users. We seek to forge relationships throughout an organization in an effort to obtain broad consensus as part of the sales process. We leverage the full power of Telos (executives, field sales and channel partners) to gain access and build our brand awareness. Our sales strategy is to establish a customer foothold with one of our solutions and work to achieve rapid success. We then leverage this customer relationship to generate interest in other solutions from the Telos portfolio. We have a variety of upsell opportunities that allow us to expand our presence within a customer account. For example, there are various complementary Xacta features that build on each other and are sold separately. Much of our business is awarded through submission of formal competitive bids, though a significant portion of our revenue is awarded through limited competition or sole-source contracts. Partner Organization Our sales team works with partner organizations like AWS, Microsoft Azure, and Oracle to pursue mutual customers and leverage their marketplace platforms and marketing programs. 15 Table of Contents We also forged new multi-partner partnerships to launch cybersecurity go-to-market plays such as Faster ATO with Splunk, Telos and ThreatAlert® ("FASTTR") on AWS, which launched at the AWS Summit in September 2021 and yielded two new wins, including Wickr and RedHat. By building on the success of our FASTTR program, we expect to launch additional multi-partner go-to-market security solutions. One such initiative is a pending partnership with a leading provider of cloud and security services. We will continue to expand on these targeted go-to-market programs to help solve security challenges facing Fortune 500 companies and expand our reach in new markets. These relationships are powerful examples of our current channel sales strategy, which we are in the process of expanding. Marketing We build market awareness of Telos and our solutions through a variety of marketing programs, including regular briefings with industry analysts, public relations activities, government relations initiatives, web seminars, trade show exhibitions, speaking engagements, and website marketing. We are making additional investments in these types of activities and targeting additional vertical-specific content creation, targeted advertising and brand awareness campaigns, social media campaigns, and search engine marketing. Our sales team works hand in hand with our marketing team and various subject matter experts to develop targeted awareness campaigns for our various solutions that generate valuable leads and contacts. Tracking and Reporting We track sales and marketing metrics using a formal customer relationship management ("CRM") system and processes to include integrated marketing automation and a partner portal for deal registration, enablement, co-branded marketing and more. This robust platform enables the Telos business leaders and executives to have real time insights into useful information about our performance and forecast. Competition We operate in a highly competitive marketplace. Although companies provide offerings that overlap with some of our solutions, we are not aware of any single company that offers competitive solutions in all of the areas where we compete. The primary companies with which our solutions compete range from security solutions and software organizations such as CLEAR (operated by Alclear, LLC), Cutting Edge, IDEMIA, MetricStream Inc., Palantir Technologies Inc., RSA Archer, ServiceNow, Inc., and Unisys Corporation, to more traditional government services integrators that provide products and services such as Booz Allen Hamilton Inc., General Dynamics Corporation, Lockheed Martin Corporation, Northrop Grumman Corporation, and Science Applications International Corporation. The majority of our business is in response to competitive requests from potential and current customers. Decisions regarding contract awards by our customers typically are based upon an assessment of the quality of our past performance, responsiveness to proposal requirements, uniqueness of the offering itself, price, and other competitive factors. Aside from other companies that compete in our space, we sometimes face indirect competition from solutions developed “in-house” by our customers. Human Capital Resources - Our People and Culture As of December 31, 2021, we had 849 employees, of which approximately 62% of our U.S.-based employees held security clearances. Our people are proficient in many fields such as computer science, information security and vulnerability testing, networking technologies, physics, engineering, operations research, mathematics, economics, and business administration. We place a high value on our people. As a result, we seek to remain competitive in terms of salary structures, incentive compensation programs, fringe benefits, opportunities for growth, and individual recognition and award programs. 16 Table of Contents Our management team is committed to maintaining a corporate culture that fosters mutual respect and job satisfaction for our people while delivering innovation and value to customers and shareholders. This commitment is reflected in our core values. Always with integrity, at Telos we: Build trusted relationships, Work hard together, Design and deliver superior solutions, and Have fun doing it. These values are woven throughout the fabric of Telos. They are reflected in our hiring practices, reinforced regularly, and reviewed during appraisals. Employees are encouraged to challenge themselves and each other to exhibit the core values in everyday activities. Our employees are also given avenues of communication and interaction should they observe activities that are inconsistent with our core values. While employees are encouraged first to speak openly about any issues, a hotline provides an opportunity to express concerns anonymously. We consider the foundational value of integrity to be a non-negotiable requirement of employment, and an expectation of suppliers, partners, and our customers. We guard our reputation and will take action to protect it. An essential part of our brand promise is to always engage employees, customers, partners, suppliers, and investors with integrity. Government Contracts and Regulation Our business is heavily regulated and we must comply with and are affected by laws and regulations relating to the formation, administration and performance of U.S. government and other contracts. U.S. government contracts generally are subject to the Federal Acquisition Regulation ("FAR"), which sets forth policies, procedures and requirements for acquiring goods and services by the U.S. government, and agency-specific regulations that implement or supplement the FAR. These regulations impose a broad range of requirements, many of which are unique to government contracting, including various procurement, security, contract pricing and cost, contract termination, and adjustments and audit requirements. These laws and regulations, among other things: • Impose specific and unique cost accounting practices that may differ from Generally Accepted Accounting Principles (“GAAP”) in the United States of America and therefore require reconciliation; • Define allowable and unallowable costs and otherwise govern our right to reimbursement under various cost-type U.S. government contracts; • Require compliance with U.S. government Cost Accounting Standards ("CAS"); • Require reviews by the Defense Contract Audit Agency ("DCAA"), Defense Contract Management Agency ("DCMA") and other U.S. government agencies for compliance with government requirements for a contractor's business system; • Restrict the use and dissemination of and require the protection of unclassified contract-related information and information classified for national security purposes and the export of certain products and technical data; • Impose acquisition regulations that define reimbursable and non-reimbursable costs; and • Restrict the use and dissemination of information classified for national security purposes and the export of certain products and technical data. 17 Table of Contents The U.S. government customers employ several contracting methods to purchase services and products. Budgetary pressures and reforms in the procurement process have caused many U.S. government customers to increasingly purchase services and products using contracting methods that allow them to select multiple contract winners or pre-qualify certain contractors to provide services or products on established general terms and conditions rather than through single-award contracts. The predominant contracting methods through which U.S. government agencies procure services and products include the following: • Definitive Award Contracts. U.S. government agencies may procure services and products through single definitive award contracts which specify the scope of services or products purchased and identify the contractor that will provide the specified services or products. When the agency has a requirement, the agency will issue a solicitation or request for proposal to which interested contractors can submit a proposal. For the contractor, this contracting method may provide greater certainty of the timing and amounts to be received at the time of contract award because it generally results in the customer contracting for a specific scope of services or products from the single definitive successful awardee. • Indefinite Delivery / Indefinite Quantity ("IDIQ") Contracts. The U.S. government uses IDIQ contracts to obtain commitments from contractors to provide certain services or products on pre-established terms and conditions. The U.S. government then issues task orders under the IDIQ contracts to purchase the specific services or products it needs. IDIQ contracts are awarded to one or more contractors following a competitive procurement process. Under a single award IDIQ contract, all task orders under that contract are awarded to one pre-selected contractor. Under a multi-award IDIQ contract, task orders can be awarded to any of the pre-selected contractors, which can result in further limited competition for the award of task orders. Multi-award IDIQ contracts that are open for any government agency to use for the procurement of services are commonly referred to as "government-wide acquisition contracts" or "GWACs." IDIQ contracts often have multi-year terms and unfunded ceiling amounts, therefore enabling, but not committing, the U.S. government to purchase substantial amounts of services or products from one or more contractors. At the time an IDIQ contract is awarded (prior to the award of any task orders), a contractor may have limited or no visibility as to the ultimate number of services or products that the U.S. government will purchase under the contract, and in the case of a multi-award IDIQ the contractor from which such purchases may be made. • U.S. General Services Administration ("GSA") Schedule Contracts. The GSA maintains a listing of approved suppliers of services and products with agreed-upon prices for use throughout the U.S. government. To provide services under the GSA Schedule contract, a company must be pre-qualified and awarded a contract by the GSA. When an agency uses a GSA Schedule contract to meet its requirements, the agency, or the GSA on behalf of the agency, conducts the procurement. The user agency, or the GSA on its behalf, evaluates the user agency's requirements and initiates a competition limited to GSA Schedule qualified contractors. GSA Schedule contracts are designed to provide the user agency with reduced procurement time and lower procurement costs. Similar to IDIQ contracts, at the time a GSA Schedule contract is awarded, a contractor may have limited or no visibility as to the ultimate amount of services or products that the U.S. government will purchase under the contract. Government contracts are subject to congressional funding. Consequently, at the outset of a program, a contract is usually partially funded, and Congress annually determines if additional funds are to be appropriated to the contract. All of our government customers have the right to terminate their contract with us at their convenience or in the event that we default. Most of our contracts have cancellation terms that would permit us to recover all or a portion of our incurred costs and fees for work performed where the U.S. government issues a termination for convenience. A portion of our business is classified by the U.S. government and cannot be specifically described. The operating results of these classified programs are included in our consolidated financial statements. These regulations and risks are described in more detail below under "Risk Factors" in this Annual Report on Form 10-K. COVID-19 Pandemic COVID-19 was first reported in late 2019 and has since dramatically impacted the global health and economic environment, including millions of confirmed cases, business slowdowns or shutdowns, government challenges and market volatility. In March 2020, the World Health Organization characterized COVID-19 as a global pandemic, and the President of the United States declared a national emergency concerning the COVID-19 outbreak. 18 Table of Contents We continue to monitor and address the developments closely, including the impact on us, our employees, our customers, our suppliers and our communities. We continue to consider guidance from the Centers for Disease Control (CDC), other health organizations, federal, state and local governmental authorities, and our customers, among others. We have taken, and continue to take, robust actions to help protect our employees' health, safety and well-being, support our suppliers and local communities, and to continue to serve our customers. Our goals have been to lessen the immediate potential adverse impacts, both health and economic, and to continue to position the Company for long-term success. Like the communities in which we serve, our actions have varied depending on the spread of COVID-19 and local health requirements, the needs of our employees and the needs of our business. Among other actions, we have required or enabled employees to work from home or remotely where practicable, and expanded IT and communication support to enhance their productivity; adjusted work spaces and shift schedules to facilitate social distancing for those who continue to work in our facilities; enhanced cleaning and disinfecting procedures at our facilities; required face coverings; implemented visitor protocols; and restricted travel. Earlier in the COVID-19 pandemic and at times of higher transmission, many state and local jurisdictions implemented mandatory stay-at-home or shelter-in-place orders. Most of those orders exempted some or all of the defense industrial base, including us and many of our suppliers, as part of the essential or critical infrastructure. Our facilities have largely remained open and many of our employees who cannot work remotely are continuing to come to work and support our customers’ national security and mission-essential operations. Towards the end of the second quarter of 2020, some state and local jurisdictions started to lift mandatory stay-at-home or shelter-in-place orders and started gradually to ease restrictions. In 2021, after the FDA approval of the COVID-19 vaccine and as the infection numbers began to decrease, some employees who had been working remotely gradually returned to the workplace. Executive Order ("EO") 14042, Ensuring Adequate COVID Safety Protocol for Federal Contractors, issued in September 2021, when implemented, requires government contractors and subcontractors to comply with certain COVID-19 safeguards in workplaces with covered individuals, including vaccination, marking and physical distancing protocols. We were taking steps to comply with the EO at affected locations, until it was challenged in, and stayed by, the Federal courts in late 2021. We will resume our efforts if and when required after resolution in the Federal courts. Later in 2021, due to the spread of infections of the COVID-19 variants and the rise in the number of cases, particularly in the third and fourth quarter of 2021, we temporarily paused our efforts to bring more employees back to the work place. Throughout, we have worked to adapt and to take robust actions to protect the health, safety and well-being of our employees and to serve our customers, considering, among other things, local circumstances, state and local requirements and guidance from the CDC. We have experienced and expect to continue to experience various increased costs to maintain our operations, including as a result of actions taken to protect the health, safety and well-being of our employees; because of illness, quarantines, and absenteeism; as a result of government actions; and because of disruption and stress among our suppliers and customers. We have also experienced certain lower costs, including those related to employee travel, some health benefits and personal time off. We continue to monitor this situation closely and cannot predict how it will change, including the extent of any increase in the number of COVID-19 cases and the costs and impacts to us. Our customers have generally continued to make timely payments. Again, however, our customers face tremendous demands and budget pressures, and we cannot predict how this may change and how they will continue to allocate limited resources. This may result in a change in spending priorities on the part of our customers, which could precipitate the cancellation, delay or deferral of programs, contracts or business opportunities. Our employees, suppliers and customers, the Company and our global community are facing tremendous challenges as a result of the pandemic and its resulting economic impacts, and we cannot predict how this dynamic situation will evolve or the impact it will have on the Company. See Item 1A, "Risk Factors," for discussion of risk related to our business and operations. Backlog We develop our annual budgeted revenue by estimating for the upcoming year our continuing business from existing customers and active contracts. We consider backlog, both funded and unfunded (as explained below), other expected annual renewals, and expansion planned by our current customers. 19 Table of Contents Total backlog consists of the aggregate contract revenues remaining to be earned by us at a given time over the life of our contracts, whether funded or unfunded. Funded backlog consists of the aggregate contract revenues remaining to be earned at a given time, which, in the case of U.S. government contracts, means that they have been funded by the procuring agency. Unfunded backlog is the difference between total backlog and funded backlog and includes potential revenues that may be earned if customers exercise delivery orders and/or renewal options to continue these contracts. Based on historical experience, we generally assume option year renewals to be exercised. Most of our customers fund contracts on a basis of one year or less and, as a result, funded backlog is generally expected to be earned within one year from any point in time, whereas unfunded backlog is expected to be earned over a longer period. The estimated value of our total backlog was as follows (in thousands): Years Ended December 31, 2021 2020 Security Solutions Funded backlog $ 35,382 $ 41,619 Unfunded backlog 54,198 43,056 Total Security Solutions backlog 89,580 84,675 Secure Networks Funded backlog 88,097 86,116 Unfunded backlog 68,730 172,664 Total Secure Networks backlog 156,827 258,780 Total Funded backlog 123,479 127,735 Unfunded backlog 122,928 215,720 Total backlog $ 246,407 $ 343,455 Company Website and Available Information Our corporate headquarters is located at 19886 Ashburn Road, Ashburn, Virginia 20147 and our telephone number is (703) 724-3800. Our website can be accessed at www.telos.com, which contains information about our Company and operations. Through a link on the Investor Relations section of our website, copies of each of our filings with the U.S. Securities and Exchange Commission ("SEC") can be viewed and downloaded free of charge as soon as reasonably practicable after the reports and amendments are electronically filed with or furnished to the SEC. The information on our website is not incorporated by reference into and is not part of this Annual Report on Form 10-K. The SEC also maintains a website (www.sec.gov) that contains reports, proxy and information statements, and other information regarding issuers that file electronically with the SEC, including Telos. 20 Table of Contents